5 ms·

So the signing key for Samsung Android phones were leaked so that any software that is loaded is signed such that it comes from the App Store is trusted. The pr

So the signing key for Samsung Android phones were leaked so that any software that is loaded is signed such that it comes from the App Store is trusted. The problem for OEMs is that developing and distributing a new key requires a Firmware update and it isn't trivial to develop for QA/QC because if they make a mistake with the keys then devices could be unable to load apps from the App Store.

phkahler 4y ago
>> and it isn't trivial to develop for QA/QC because if they make a mistake with the keys then devices could be unable to load apps from the App Store. Well then they better do some f..ing testing. They're only one of the biggest tech companies in existence. Making phones isn't trivial either!
- mschuster91 4y ago
  Making a phone is dead easy: contract one of the ton of third party manufacturers in China to supply you with one of their white-label designs, pay for them and ship them. The stuff around it is where the complexity lies: making sure you get updates and have infrastructure to distribute these to customers, that you apply for and get certifications from regulatory agencies and, in the US, carriers, deal with e-waste and warranty regulatory requirements (which is a pain in the EU), establish a supply chain for spare parts...
lern_too_spel 4y ago
Not any app installed from the app store but any app signed using Samsung's keys. Such an app could get any permission it pleases when installed. The app store can easily block apps signed with Samsung's keys, but a few people can probably be convinced to download the app outside the app store, which could easily be flagged by Play Protect if it is a Google-flavored phone, preventing install. I don't know if these systems have actually been updated to do this, but I imagine they would be.

5 ms·

So the signing key for Samsung Android phones were leaked so that any software that is loaded is signed such that it comes from the App Store is trusted. The pr

by zitterbewegung 4y ago

phkahler 4y ago
>> and it isn't trivial to develop for QA/QC because if they make a mistake with the keys then devices could be unable to load apps from the App Store. Well then they better do some f..ing testing. They're only one of the biggest tech companies in existence. Making phones isn't trivial either!
- mschuster91 4y ago
  Making a phone is dead easy: contract one of the ton of third party manufacturers in China to supply you with one of their white-label designs, pay for them and ship them. The stuff around it is where the complexity lies: making sure you get updates and have infrastructure to distribute these to customers, that you apply for and get certifications from regulatory agencies and, in the US, carriers, deal with e-waste and warranty regulatory requirements (which is a pain in the EU), establish a supply chain for spare parts...
lern_too_spel 4y ago
Not any app installed from the app store but any app signed using Samsung's keys. Such an app could get any permission it pleases when installed. The app store can easily block apps signed with Samsung's keys, but a few people can probably be convinced to download the app outside the app store, which could easily be flagged by Play Protect if it is a Google-flavored phone, preventing install. I don't know if these systems have actually been updated to do this, but I imagine they would be.